In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injection attacks.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade maven-resolver-utilUpgrade atinjectUpgrade guavaUpgrade maven-resolverUpgrade maven-wagon-httpUpgrade jansi-nativeUpgrade plexus-utilsUpgrade plexus-interpolationUpgrade mavenUpgrade google-guiceUpgrade glassfish-el-apiUpgrade maven-resolver-spiUpgrade maven-wagon-http-sharedUpgrade httpcomponents-coreUpgrade maven-shared-utilsUpgrade maven-wagon-provider-apiUpgrade sisu-injectUpgrade maven-resolver-transport-wagonUpgrade plexus-classworldsUpgrade jsoupUpgrade httpcomponents-clientUpgrade maven-resolver-implUpgrade jboss-interceptors-1.2-apiUpgrade geronimo-annotationUpgrade guava20Upgrade aopallianceUpgrade cdi-apiUpgrade apache-commons-loggingUpgrade jsr-305Upgrade plexus-containers-component-annotationsUpgrade maven-wagon-fileUpgrade apache-commons-ioUpgrade sisuUpgrade apache-commons-cliUpgrade plexus-cipherUpgrade maven-resolver-apiUpgrade slf4jUpgrade jcl-over-slf4jUpgrade apache-commons-lang3Upgrade hawtjni-runtimeUpgrade maven-openjdk17Upgrade apache-commons-codecUpgrade maven-wagonUpgrade maven-openjdk11Upgrade maven-openjdk8Upgrade maven-libUpgrade plexus-sec-dispatcherUpgrade maven-resolver-connector-basicUpgrade jansiUpgrade sisu-plexus | Jun 7, 2022 | May 23, 2022 |
| Amazon Linux Ami 2 | — | Upgrade maven-shared-utilsUpgrade maven-shared-utils-javadoc | Jul 4, 2022 | May 23, 2022 |
| Centos_linux | — | Upgrade plexus-utilsUpgrade sisuUpgrade apache-commons-codecUpgrade jboss-interceptors-1.2-apiUpgrade maven-shared-utilsUpgrade guavaUpgrade plexus-sec-dispatcherUpgrade slf4jUpgrade maven-resolver-implUpgrade glassfish-el-apiUpgrade httpcomponents-clientUpgrade maven-wagon-fileUpgrade jansiUpgrade cdi-apiUpgrade maven-openjdk17Upgrade plexus-cipherUpgrade maven-shared-utils-javadocUpgrade maven-wagonUpgrade maven-resolver-utilUpgrade aopallianceUpgrade maven-resolver-transport-wagonUpgrade maven-wagon-http-sharedUpgrade maven-wagon-provider-apiUpgrade guava20Upgrade sisu-plexusUpgrade plexus-classworldsUpgrade maven-wagon-httpUpgrade google-guiceUpgrade jsr-305Upgrade maven-resolver-connector-basicUpgrade httpcomponents-coreUpgrade hawtjni-runtimeUpgrade jansi-nativeUpgrade plexus-containers-component-annotationsUpgrade geronimo-annotationUpgrade atinjectUpgrade jsoupUpgrade jcl-over-slf4jUpgrade apache-commons-loggingUpgrade apache-commons-ioUpgrade apache-commons-cliUpgrade sisu-injectUpgrade plexus-interpolationUpgrade maven-resolver-spiUpgrade maven-libUpgrade mavenUpgrade apache-commons-lang3Upgrade maven-resolver-apiUpgrade maven-resolverUpgrade maven-openjdk11Upgrade maven-openjdk8 | May 2, 2022 | Apr 26, 2022 |
| Debian | — | Upgrade maven-shared-utils | Jun 28, 2022 | May 23, 2022 |
| Oracle Weblogic | — | Apply the Patch Set Update (PSU) 35904051 for version 14.1.1.0.0. | Oct 19, 2023 | May 23, 2022 |
| Oracle_linux | — | Upgrade sisu-injectUpgrade apache-commons-ioUpgrade jsr-305Upgrade cdi-apiUpgrade maven-shared-utils-javadocUpgrade maven-wagon-fileUpgrade jboss-interceptors-1.2-apiUpgrade apache-commons-lang3Upgrade hawtjni-runtimeUpgrade plexus-containers-component-annotationsUpgrade jcl-over-slf4jUpgrade slf4jUpgrade plexus-utilsUpgrade apache-commons-codecUpgrade maven-resolver-implUpgrade httpcomponents-coreUpgrade maven-openjdk17Upgrade glassfish-el-apiUpgrade maven-resolver-connector-basicUpgrade plexus-cipherUpgrade maven-wagonUpgrade plexus-sec-dispatcherUpgrade maven-wagon-provider-apiUpgrade maven-openjdk11Upgrade sisuUpgrade maven-libUpgrade jansiUpgrade maven-resolver-transport-wagonUpgrade jansi-nativeUpgrade maven-wagon-http-sharedUpgrade apache-commons-cliUpgrade apache-commons-loggingUpgrade aopallianceUpgrade sisu-plexusUpgrade atinjectUpgrade maven-resolverUpgrade google-guiceUpgrade geronimo-annotationUpgrade plexus-classworldsUpgrade guava20Upgrade maven-resolver-spiUpgrade plexus-interpolationUpgrade mavenUpgrade maven-shared-utilsUpgrade maven-wagon-httpUpgrade maven-openjdk8Upgrade maven-resolver-utilUpgrade httpcomponents-clientUpgrade guavaUpgrade jsoupUpgrade maven-resolver-api | Apr 30, 2022 | May 29, 2020 |
| Redhat Openshift | — | Upgrade jenkins-2-plugins | Jan 5, 2023 | May 29, 2020 |
| Redhat_linux | — | Upgrade geronimo-annotationUpgrade apache-commons-lang3Upgrade maven-resolver-utilUpgrade apache-commons-ioUpgrade plexus-cipherUpgrade maven-resolver-apiUpgrade sisu-plexusUpgrade maven-wagon-fileUpgrade maven-shared-utils-javadocUpgrade hawtjni-runtimeUpgrade glassfish-el-apiUpgrade jcl-over-slf4jUpgrade sisuUpgrade maven-openjdk11Upgrade jsoupUpgrade maven-resolver-implUpgrade maven-openjdk8Upgrade maven-wagonUpgrade cdi-apiUpgrade mavenUpgrade maven-libUpgrade plexus-sec-dispatcherUpgrade maven-openjdk17Upgrade jsr-305Upgrade maven-wagon-http-sharedUpgrade maven-resolver-connector-basicUpgrade plexus-interpolationUpgrade plexus-classworldsUpgrade guavaUpgrade maven-resolver-transport-wagonUpgrade maven-wagon-httpUpgrade slf4jUpgrade apache-commons-loggingUpgrade maven-resolverUpgrade maven-shared-utilsUpgrade jansi-nativeUpgrade plexus-containers-component-annotationsUpgrade apache-commons-codecUpgrade google-guiceUpgrade maven-wagon-provider-apiUpgrade httpcomponents-clientUpgrade plexus-utilsUpgrade jansiUpgrade apache-commons-cliUpgrade sisu-injectUpgrade httpcomponents-coreUpgrade jboss-interceptors-1.2-apiUpgrade atinjectUpgrade maven-resolver-spiUpgrade aopallianceUpgrade guava20 | May 2, 2022 | Apr 26, 2022 |
| Rocky_linux | — | Upgrade jansi-native | Mar 12, 2024 | May 23, 2022 |
| Suse | — | Upgrade maven-doxia-sitetools-javadocUpgrade maven-plugin-testing-javadocUpgrade maven-plugin-plugin-javadocUpgrade maven-doxia-coreUpgrade maven-reporting-apiUpgrade maven-shared-incrementalUpgrade maven-plugin-plugin-bootstrapUpgrade maven-doxia-module-rtfUpgrade maven-resolver-utilUpgrade maven-common-artifact-filters-javadocUpgrade maven-shared-incremental-javadocUpgrade maven-archiver-javadocUpgrade maven-failsafe-pluginUpgrade maven-plugin-bundleUpgrade maven-doxia-module-foUpgrade maven-artifact-managerUpgrade maven-doxia-module-aptUpgrade maven-jar-pluginUpgrade exec-maven-plugin-javadocUpgrade xml-maven-pluginUpgrade maven-plugin-bundle-javadocUpgrade maven-wagon-http-sharedUpgrade maven-surefire-report-parserUpgrade maven-wagon-http-lightweightUpgrade maven-artifact-transfer-javadocUpgrade maven-file-management-javadocUpgrade maven-doxia-logging-apiUpgrade maven-doxia-sink-apiUpgrade maven-doxia-javadocUpgrade maven-localUpgrade maven-plugin-testing-harnessUpgrade maven-surefire-plugins-javadocUpgrade maven-assembly-plugin-javadocUpgrade maven-plugin-build-helper-javadocUpgrade maven-dependency-plugin-javadocUpgrade maven-clean-pluginUpgrade javacc-maven-plugin-javadocUpgrade maven-enforcer-apiUpgrade maven-javadoc-pluginUpgrade maven-plugin-testing-toolsUpgrade maven-dependency-tree-javadocUpgrade maven-resolver-transport-wagonUpgrade modello-maven-pluginUpgrade maven-antrun-plugin-javadocUpgrade string-template-maven-pluginUpgrade maven-dependency-pluginUpgrade maven-plugin-tools-apiUpgrade maven-shared-ioUpgrade maven-enforcerUpgrade maven-mapping-javadocUpgrade maven-surefireUpgrade javacc-maven-pluginUpgrade maven-plugin-annotationsUpgrade maven-clean-plugin-javadocUpgrade maven-shared-utilsUpgrade maven-javadoc-plugin-javadocUpgrade maven-assembly-pluginUpgrade maven-modelUpgrade maven-plugin-tools-javadocUpgrade maven-install-plugin-javadocUpgrade maven-plugin-testingUpgrade maven-wagon-javadocUpgrade maven-resolver-transport-httpUpgrade spec-version-maven-pluginUpgrade maven-surefire-pluginUpgrade spec-version-maven-plugin-javadocUpgrade maven-source-pluginUpgrade maven-wagon-fileUpgrade maven-reporting-api-javadocUpgrade maven-enforcer-pluginUpgrade maven-resources-pluginUpgrade maven-resolver-implUpgrade maven-file-managementUpgrade gmavenplus-pluginUpgrade maven-profileUpgrade maven-doxia-module-twikiUpgrade maven-projectUpgrade maven-archiverUpgrade maven-common-artifact-filtersUpgrade paranamer-maven-pluginUpgrade maven-wagon-ssh-externalUpgrade maven-remote-resources-pluginUpgrade maven-plugin-tools-antUpgrade os-maven-pluginUpgrade maven-resolver-transport-classpathUpgrade modello-maven-plugin-javadocUpgrade antlr4-maven-pluginUpgrade xml-maven-plugin-javadocUpgrade maven-surefire-provider-junit5Upgrade maven-resolver-connector-basicUpgrade maven-enforcer-javadocUpgrade maven-compiler-pluginUpgrade maven-resources-plugin-bootstrapUpgrade maven-javadocUpgrade maven-compiler-plugin-javadocUpgrade maven-shared-io-javadocUpgrade maven-surefire-provider-junitUpgrade hawtjni-maven-plugin-javadocUpgrade maven-invokerUpgrade exec-maven-pluginUpgrade maven-jar-plugin-javadocUpgrade maven-plugin-build-helperUpgrade maven-resolver-transport-fileUpgrade maven-surefire-report-plugin-bootstrapUpgrade maven-wagon-httpUpgrade maven-jar-plugin-bootstrapUpgrade maven-invoker-javadocUpgrade maven-filteringUpgrade maven-doxia-module-xhtmlUpgrade maven-doxia-test-docsUpgrade maven-doxia-module-docbook-simpleUpgrade maven-dependency-analyzerUpgrade maven-doxia-module-xhtml5Upgrade maven-antrun-pluginUpgrade maven-wagon-sshUpgrade maven-artifact-resolverUpgrade maven-resources-plugin-javadocUpgrade maven-verifierUpgrade maven-resolver-test-utilUpgrade maven-surefire-report-pluginUpgrade maven-shared-utils-javadocUpgrade maven-resolver-javadocUpgrade maven-plugin-tools-generatorsUpgrade maven-test-toolsUpgrade maven-monitorUpgrade maven-dependency-treeUpgrade maven-surefire-provider-testngUpgrade maven-plugin-tools-javaUpgrade maven-plugin-pluginUpgrade maven-install-pluginUpgrade maven-plugin-registryUpgrade maven-enforcer-rulesUpgrade tesla-polyglot-maven-pluginUpgrade maven-dependency-analyzer-javadocUpgrade maven-plugin-tools-modelUpgrade maven-source-plugin-javadocUpgrade maven-surefire-javadocUpgrade maven-wagon-provider-apiUpgrade string-template-maven-plugin-javadocUpgrade maven-resolver-apiUpgrade maven-compiler-plugin-bootstrapUpgrade maven-plugin-tools-annotationsUpgrade maven-libUpgrade maven-resolver-spiUpgrade bnd-maven-plugin-javadocUpgrade bnd-maven-pluginUpgrade maven-doxia-module-latexUpgrade maven-surefire-provider-junit5-javadocUpgrade maven-wagon-ssh-commonUpgrade hawtjni-maven-pluginUpgrade maven-artifact-resolver-javadocUpgrade maven-doxia-module-fmlUpgrade maven-mappingUpgrade maven-failsafe-plugin-bootstrapUpgrade maven-doxia-module-confluenceUpgrade maven-filtering-javadocUpgrade maven-javadoc-plugin-bootstrapUpgrade maven-toolchainUpgrade maven-remote-resources-plugin-javadocUpgrade maven-doxia-sitetoolsUpgrade maven-doxia-module-xdocUpgrade gmavenplus-plugin-javadocUpgrade os-maven-plugin-javadocUpgrade maven-wagon-ftpUpgrade maven-surefire-plugin-bootstrapUpgrade maven-plugin-tools-beanshellUpgrade mavenUpgrade maven2-javadocUpgrade maven-artifact-transferUpgrade maven-settingsUpgrade maven-script-beanshellUpgrade maven-artifactUpgrade maven-verifier-javadocUpgrade maven-plugin-descriptorUpgrade maven-resolverUpgrade maven-script-antUpgrade maven-resolver-named-locks | Mar 20, 2023 | May 23, 2022 |
| Ubuntu | — | Upgrade libmaven-shared-utils-java (Ubuntu Pro)Upgrade libmaven-shared-utils-java | Apr 12, 2024 | May 23, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub